# CVE-2026-121289

Crafted packet crashes Arista EOS BGP agent, causing session loss and possible RCE.

- Page: https://www.vulneraibility.com/cve/CVE-2026-121289
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-121
- Published: 2026-11-10

## Affected versions

- Arista Networks EOS: affected >= 4.36.0F and <= 4.36.2F; >= 4.35.0F and <= 4.35.6M; >= 4.34.0F and <= 4.34.8M; >= 4.33.0F and <= 4.33.10M; >= 4.25.1F and < 4.33.0F

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote crafted BGP packet can terminate the BGP agent, dropping all BGP sessions and potentially enabling arbitrary code execution and full device compromise.

## Action

Immediate action required

## Recommendation

Apply vendor advisories/patches ASAP; restrict BGP peers, filter/inspect BGP traffic, and monitor sessions.

## References

- [advisory] https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.